2025

The WP Reset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including,

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a post's Featur

A weakness has been identified in code-projects Simple Banking System 1.0. Impacted is an unknown function of the file /

A security flaw has been discovered in code-projects Simple Banking System 1.0. This issue affects some unknown processi

A flaw has been found in code-projects Online Hotel Reservation System 1.0. Affected is an unknown function of the file

A vulnerability was detected in code-projects Online Hotel Reservation System 1.0. This impacts an unknown function of t

A security vulnerability has been detected in code-projects Online Hotel Reservation System 1.0. This affects an unknown

A weakness has been identified in code-projects Online Hotel Reservation System 1.0. The impacted element is an unknown

The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0

The YoSmart YoLink API through 2025-10-02 uses an endpoint URL that is derived from a device's MAC address along with an

The YoSmart YoLink Smart Hub firmware 0382 is unencrypted, and data extracted from it can be used to determine network a

The YoSmart YoLink MQTT broker through 2025-10-02 does not enforce sufficient authorization controls to prevent cross-ac

Components of the YoSmart YoLink ecosystem through 2025-10-02 leverage unencrypted MQTT to communicate over the internet

A vulnerability has been found in ILIAS up to 8.23/9.13/10.1. This affects the function unserialize of the component Bas

A flaw has been found in ILIAS up to 8.23/9.13/10.1. Affected by this issue is the function unserialize of the component

A vulnerability was detected in ILIAS up to 8.23/9.13/10.1. Affected by this vulnerability is an unknown functionality o

A stored Cross-site scripting (XSS) vulnerability exists in the Customer Management Module of LionCoders SalePro POS 5.4

Phpgurukul Hostel Management System 2.1 is vulnerable to clickjacking.

A weakness has been identified in code-projects Online Course Registration 1.0. This impacts an unknown function of the

Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including

Bucket is a MediaWiki extension to store and retrieve structured data on articles. Prior to version 1.0.0, infinite recu

Directory Traversal vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0076-000 Ver 4.00

Cross Site Scripting (XSS) vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 V

In AMD Zynq UltraScale+ devices, the lack of address validation when executing CSU runtime services through the PMU Firm

python-socketio is a Python implementation of the Socket.IO realtime client and server. A remote code execution vulnerab

Cross Site Scripting vulnerability in DokuWiki 2025-05-14a 'Librarian'[56.1] allows a remote attacker to execute arbitra

A stored cross-site scripting (XSS) vulnerability in Optimod 5950 - Optimod 5950HD - Optimod 5750 - Optimod 5750HD - Opt

A vulnerability was detected in Four-Faith Water Conservancy Informatization Platform up to 2.2. This affects an unknown

A security vulnerability has been detected in Four-Faith Water Conservancy Informatization Platform up to 2.2. Affected

A weakness has been identified in D-Link DI-7100G C1 up to 20250928. Affected by this vulnerability is the function sub_

A vulnerability was found in IdeaCMS up to 1.8. The impacted element is an unknown function of the file app/common/logic

A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. The affected element is an unknown fu

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Logo Softwa

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Logo Software Inc. Logo Cloud allows Phishing, Forc

Improper Encoding or Escaping of Output vulnerability in Logo Software Inc. Logo Cloud allows Phishing. This issue affe

Authorization Bypass Through User-Controlled Key vulnerability in Logo Software Inc. Logo Cloud allows Forceful Browsing

The credentials of the users stored in the system's local database can be used for the log in, making it possible for an

JavaScript can be ran inside the address bar via the dashboard "Open in new Tab" Button, making the application vulnerab

A remote, unauthorized attacker can brute force folders and files and read them like private keys or configurations, mak

It's possible to brute force folders and files, what can be used by an attacker to steal sensitve information.

The application does not implement sufficient measures to prevent multiple failed authentication attempts within a short

For failed login attempts, the application returns different error messages depending on whether the login failed due to

Multiple endpoints with sensitive information do not require authentication, making the application susceptible to infor

In the HTTP request, the username and password are transferred directly in the URL as parameters. However, URLs can be s

The application provides access to a login protected H2 database for caching purposes. The username is prefil

If a user tries to login but the provided credentials are incorrect a log is created. The data for this POST requests is

When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and metho

An API endpoint allows arbitrary log entries to be created via POST request. Without sufficient validation

Due to a lack of authentication, it is possible for an unauthenticated user to request data from this endpoint, making t

The Responsive Lightbox & Gallery WordPress plugin before 2.5.3 does not properly handle HTML tag attributes modificatio